CODEWITHSUNDEEP
phpsymfonyrolesapi-platform.com
SAFSAF
SAFSAF

Reputation: 405

How to protect api plateform operations with privileges

I have an api plateform project (symfony) that contain an entity User with column Roles(array), I have 3 ROLES: ROLE_USER, ROLE_COMMERCIAL, ROLE_ADMIN, I am protecting my operations likes this:

"get"={
     "access_control"="is_granted('ROLE_ADMIN')",
     "security_post_denormalize_message"="Sorry, Only admins can View Users List"
}

But What I would to achieve is to give each user privileges like for example a user can view users list but cannot edit it , I want to edit the privileges for each user later that's why I don't want to use the role column. I think of this tables structure :

Upvotes: 0

Views: 58

Answers (1)

bja34
bja34

Reputation: 11

you checkout voters (https://symfony.com/doc/master/security/voters.html) . It won't be exactly like you wanted , but it's the easiest way to give privileges, in your case to allow a user to view a list but not to edit it.

Upvotes: 1

Related Questions